Dashboards & Visualizations

How to display an event count deviation?

matthew_foos
Path Finder

Hello all,

I've been tasked with building a standard deviation alert / dashboard / report by using the total count of events over 7 days. I've tried the following search with no success:

| metadata type=hosts index=* which gives me a totalCount of events for my hosts.

I'm trying to figure out how to display any deviation that is +/- 10% and alert on this.

I'm happy to provide further information.

Thanks!

0 Karma

kmaron
Motivator

okay try this

base search 
| bucket _time span=1d
| stats count BY _time countedfield
| eventstats stdev(count) as stdev BY countedfield
| eval stdevincrease = (stdev*1.1)
| where count > stdevincrease AND _time > now()-(24*60*60)

Set your earliest to be 7 days and your latest to be now.
Your buckets are 1 day time spans
the eventstats will do the standard deviation over the 7 days then the where clause only looks at the last day
So you can set your alert to trigger on anything greater than 0

0 Karma

kmaron
Motivator

a deviation over what time frame? You said 7 days for the total count but are you comparing daily? hourly?

0 Karma

matthew_foos
Path Finder

I will be comparing daily.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...